Skip to content

feat(qr-link): add version-aware verify_qr function#1151

Open
danielle-tfh wants to merge 7 commits intomainfrom
danielle/qr-link-verify-qr
Open

feat(qr-link): add version-aware verify_qr function#1151
danielle-tfh wants to merge 7 commits intomainfrom
danielle/qr-link-verify-qr

Conversation

@danielle-tfh
Copy link
Copy Markdown
Contributor

@danielle-tfh danielle-tfh commented Apr 10, 2026

Promote orb-relay-messages from dev-dep to dep (behind the decode feature) so orb-qr-link owns the full decode → verify cycle.

Adds decode_and_verify_qr(qr, app_data) -> Result<(Uuid, bool), DecodeError> which decodes the QR string and verifies the hash in one step. Version dispatch (v4 legacy BLAKE3 vs v5 length-prefixed) is handled internally — callers don't need to know about versions.

Also consolidates the version constants (encode.rs no longer maintains its own), bumps orb-relay-messages rev to d5cf1e46, and bumps MSRV to 1.88.0.

Promote orb-relay-messages from dev-dependency to dependency so
orb-qr-link owns the full QR decode → verify cycle. Consumers no
longer need to match on version themselves.
@danielle-tfh danielle-tfh requested a review from a team as a code owner April 10, 2026 07:48
- verify_qr now returns Result<bool, UnsupportedVersion> instead of
  silently returning false for unknown versions
- Consolidate version constants: encode.rs reuses QR_VERSION_4/5 from
  lib.rs instead of maintaining separate ASCII constants
- Gate verify_qr, AppAuthenticatedData re-export, and orb-relay-messages
  dep behind a new `verify` feature (included in default)
- Bump rust-version to 1.88.0 to match orb-relay-messages MSRV
- Add cross-version rejection test through verify_qr
Drop the separate `verify` feature — verify_qr and AppAuthenticatedData
are gated behind `decode` instead, since anyone decoding will verify.
Extract verify logic into src/verify.rs to match decode/encode structure.
verify_qr consumes the (version, hash) output of decode_qr_with_version
so they belong together. Use thiserror for UnsupportedVersion to reduce
boilerplate. Remove the separate verify.rs module.
…ify_qr

Callers no longer need to care about QR versions. The new
decode_and_verify_qr(qr, app_data) handles version dispatch internally
and returns (Uuid, bool). Make decode_qr_with_version private, remove
verify_qr and UnsupportedVersion from the public API, and demote the
version constants to pub(crate).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant